logo

Linux kernel.org Hacker Arrested After Traffic Stop

ID: e4798dd7-9607-58b7-bd86-851bd40a8b48

STIX ID: report--e4798dd7-9607-58b7-bd86-851bd40a8b48

Feed Name: Darknet

Threat Score
75/100

Date Published: 2016-09-08

Date Updated: 2026-05-08

...
...

### Executive Summary DumpBrowserSecrets is a publicly documented post-exploitation credential-harvesting tool that targets Chrome, Edge, Brave (App-Bound Encryption) as well as Opera, Vivaldi (DPAPI) and Firefox (NSS). It uses Early Bird APC DLL injection into a spawned headless Chromium process to access the IElevator COM interface and decrypt the app_bound_encrypted_key, then parses and decrypts browser SQLite/JSON stores to output saved credentials, session cookies, OAuth tokens and other sensitive data as JSON; the tool includes multiple evasion features and is intended for red-team/assumed-breach use but significantly increases the real-world risk of cloud account takeover and lateral movement if used by adversaries.

Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.